406a23ff989e9ea29398993c0842f5a0202c3cffa54ef2fa21798767624d4719

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 14:15

Target

Fraps/data/Lib/Lib2.dll
Size

208KB
MD5

9eefb97a2fd4bc1d3c43db1c86033b00
SHA1

ca03c90a99fca4360213869f1d1d06075bcba44a
SHA256

9e17951c529144886b1b7c36df7885033258528c795ab2b606e95d364c519f3d
SHA512

900977b8be48dbd2ec233a4b9a9e73598a2744c4e6bf95c7e64a61c0888390cf8b74310c025f3398d2666c867d44c353df50a81d0b403e8bd948cf547303fa4e
SSDEEP

3072:BVoWeMW1/5U/yaRisXt48Lj7oW8SA1AKl0Ckq0Dq88mIilWpoZ+3bbjko:z9IxWyapX3LjMWYCKl0CTeKmMM+J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28
PID 1032 wrote to memory of 2096	1032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
  2⤵
  PID:2096